Canada Access Federation

Canada Access Federation
Name	Canada Access Federation
Abbreviation	CAF
Formation	2010s
Type	Not-for-profit consortium
Purpose	Federated identity management for research and higher education
Headquarters	Ottawa, Ontario
Region served	Canada

Canada Access Federation

The Canada Access Federation is a Canadian non-profit consortium that provides federated identity and access management services for research and higher education institutions. It enables secure single sign-on and resource sharing between identity providers and service providers across institutions such as University of Toronto, McGill University, University of British Columbia, Université de Montréal, and national research infrastructures like Compute Canada and the Canadian Light Source. The federation aligns with international initiatives including eduroam, eduGAIN, and the InCommon federation to facilitate cross-border collaboration.

Overview

The federation operates a metadata and trust framework that connects identity providers at institutions such as Simon Fraser University, Queen's University, University of Alberta, Dalhousie University, and York University with service providers like JSTOR, Springer Nature, Elsevier, ORCID, and Clarivate. It implements standards from organizations including the Internet2 consortium, the SAML standard body, and the W3C to support interoperable authentication and attribute exchange. Partnered initiatives and stakeholders include provincial research networks such as CANARIE, provincial institutions like BCNET and ORION, and pan-Canadian projects such as Research Data Canada and the Canadian Research Knowledge Network.

History

The federation emerged in the 2010s from discussions among university CIOs, identity management teams at institutions including Université Laval and Concordia University, and national infrastructure bodies like CANARIE and Compute Canada. Early pilots involved integrations with scholarly publishers and platforms including IEEE Xplore, ACM Digital Library, and Project MUSE. The federation expanded governance and technical services in response to interoperability efforts led by eduGAIN and technical guidance from Internet2 and later coordinated with provincial research networks such as ACORN-NS and RISQ. Milestones included cross-border connection agreements with eduGAIN members, adoption by regional libraries like the Toronto Public Library system, and support for national projects including Canada's Digital Research Infrastructure.

Services and Technology

Core services include metadata management, trust registry operations, certificate management, and a centralized discovery service used by institutions such as McMaster University and University of Ottawa. Technologies employed draw on SAML 2.0, OpenID Connect, OAuth 2.0, and standards promoted by OASIS and the IETF. The federation operates a metadata aggregation pipeline compatible with eduGAIN and provides tooling for attribute release policies used by repositories like Dataverse instances and platforms such as Blackboard and Moodle. It supports integration with identity providers including Shibboleth, Microsoft Entra ID, Google Workspace for Education, and cloud services from Amazon Web Services and Google Cloud Platform used by research groups.

Governance and Membership

Governance is constituted by participating institutions—universities, colleges, research consortia, libraries, and government research bodies—represented in stakeholder groups similar to boards at CANARIE and advisory bodies aligned with provincial networks such as ORION. Membership models resemble other federations like InCommon with tiers for identity providers and service providers, and committees addressing technical operations, policy, and legal frameworks. Membership agreements reference frameworks and liability considerations comparable to those in contracts with JSTOR and collaborations with funding agencies such as the Canadian Institutes of Health Research and the Natural Sciences and Engineering Research Council of Canada.

Impact and Adoption

Adoption across Canadian post-secondary institutions, libraries, and research infrastructures has simplified access to subscription resources from vendors like ProQuest, EBSCO, and Taylor & Francis while enabling collaboration on platforms like HPC systems administered by Compute Canada and regional partners. The federation has facilitated pan-Canadian research workflows in fields supported by agencies including the Canadian Space Agency and the National Research Council Canada, and has enabled mobility for visiting scholars from federations such as UK Access Management Federation and Australian Access Federation through eduGAIN interconnections.

Privacy and Security Practices

Privacy and security practices adhere to Canadian statutory frameworks including the Personal Information Protection and Electronic Documents Act and institutional policies at members such as University of Waterloo and Université de Sherbrooke. Operational security includes X.509 certificate management, metadata signing, routine audits influenced by ISO/IEC 27001 guidance, and incident response coordination with national CERT-like entities and provincial network operators such as BCNET. Attribute release is minimized by policy to the attributes required by service providers, and integrations with identity proofing services and persistent identifiers like ORCID and ISNI support accountable research identity management.

Category:Federated identity